Cybersecurity Business Analyst

This is a remote position.

• Lead structured discovery across business, cybersecurity, technology, risk, legal, privacy, procurement, and operations stakeholders. Define the problem, value hypothesis, scope, outcomes, constraints, and measurable acceptance criteria.
  
• Elicit, analyse, reconcile, and baseline business, functional, non-functional, security, privacy, regulatory, operational, and reporting requirements. Use interviews, workshops, observation, document analysis, process mapping, and data analysis.
  
• Translate cyber risks, threat scenarios, control objectives, and technical constraints into clear business language, decision papers, epics, user stories, use cases, process and data models, traceability matrices, and testable requirements.
  
• Own requirements quality and lifecycle, including versioning, prioritisation, change control, impact assessment, and traceability from the original need through design, build, testing, deployment, control evidence, and benefits realisation.
  
• Produce or coordinate programme artefacts, including demand inputs, business requirements, product descriptions, current- and future-state processes, stakeholder maps, RACI, data definitions, requirements traceability, acceptance criteria, decision logs, and readiness assessments.
  
• Partner with security architects and subject-matter experts to ensure requirements address relevant areas, such as identity and privileged access, infrastructure and cloud protection, application and API security, data protection, vulnerability and exposure management, detection and response, resilience, OT/IoT, third-party risk, and secure operations.
  
• Plan and facilitate workshops, playback sessions, design reviews, and sign-off forums. Identify assumptions, conflicts, gaps, and dependencies early, and drive them towards explicit decisions.
  
• Support sourcing and supplier engagement by defining outcome-based requirements, evaluation criteria, use cases, service levels, security obligations, evidence expectations, and responses to RFP clarification questions.
  

Requirements

• Proven senior-level business analysis experience in complex cybersecurity, technology, risk, or compliance change.
  
• Expertise in requirements elicitation, process analysis, traceability, workshop facilitation, testing, and operational readiness.
  
• Ability to translate cybersecurity, risk, and technical concepts into business requirements and decisions.
  
• Experience with RFP requirements, suppliers, global stakeholders, and hybrid delivery.
  
• Relevant degree or equivalent experience. A recognised role certification is preferred.
  
• Broad awareness of frameworks such as NIST CSF, ISO 27001, CIS Controls, and ITIL, as well as secure delivery practices, is desirable.
  

• Identity governance and administration, IAM, MFA, and SSO
  
• Privileged access management and Active Directory security
  
• Security operations, logging, SIEM, SOC integration, and incident readiness
  
• Vulnerability, exposure, and external attack-surface management
  
• Application, API, web, and cloud security
  
• Infrastructure, endpoint, network, PKI, and certificate management
  
• Data security, privacy, cryptography, and information protection
  
• Cyber resilience, backup, recovery, crisis readiness, and continuity
  
• OT/IoT and logistics-site security
  
• Third-party, supply-chain, M&A, and regulatory cyber risk
  
• Security governance, control frameworks, audit, and compliance
  
• Operationalisation, service management, and continuous control improvement